Google LLC

Complaint upheld; declaratory orders; registration ordered within 30 days. PDPO, 18 July 2025.

Record ID

ug-pdpo-2025-0002

Case reference

Complaint No. 08/11/24/6683

Jurisdiction

Uganda

Regulator

PDPO

Type

determination

Date decided

18 July 2025

Respondent type

private

Sector

technology

Violations

failure to register as data collector, controller and processor, unlawful cross-border transfer

Provisions cited

s.29 DPPA Cap 97, s.19 DPPA Cap 97, Reg 15 DPP Regulations, Reg 30 DPP Regulations

Outcome

complaint upheld; declaratory orders; registration ordered within 30 days

Status

final

Source

Official document ↗

Source integrity

SHA-256 5818656e9962a09e…

Record verified

30 July 2026

The facts

Four Ugandan complainants alleged in November 2024 that Google collects and processes personal data of Ugandans without registering with the PDPO and transfers their personal data out of Uganda without the required safeguards. In a decision of 18 July 2025 the PDPO rejected Google's argument that it had no obligations absent a physical presence in Uganda, holding that the law applies extra-territorially to any entity handling Ugandans' personal data, and found Google in breach of the registration requirement and of the cross-border transfer conditions.

Orders and outcome

Google was ordered to register with the PDPO within 30 days and to provide, within the same period, documentary evidence of how its cross-border transfers of Ugandans' personal data comply with Ugandan law, including their legal basis and accountability measures. The PDPO declined to order data localisation at this stage and made no compensation order, noting complainants may pursue compensation in court. Dated 18 July 2025.

BIG-TECH · REGISTRATION · CROSS-BORDER · EXTRATERRITORIALITY · FIRST-OF-KIND

Cite this decision

Track Uganda enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.